CODEWITHSUNDEEP
javasessionservletssession-cookies
Tito
Tito

Reputation: 9044

How unique is the HttpSession ID?

I am going to uniquely identify a user by storing a unique ID in his/her cookie. HttpSession ID is a good choice from my google search. Just wanted to know how unique it is ? Is it unique to the webcontainer or once it expires , will it get regenerated ? If it repeats, all my user login can go for a toss.Need some expert opinion on using sessonID as a unique identifier for my users.

Upvotes: 7

Views: 6214

Answers (2)

JB Nizet
JB Nizet

Reputation: 691715

A session ID must uniquely identify a session on a server, or on a cluster of servers. You don't have any guarantee of uniqueness across restarts. Why don't you simply use a database sequence, or a UUID?

Upvotes: 2

Matt Ball
Matt Ball

Reputation: 359786

Session IDs are unique and meaningful only for the lifetime of a session. A session ID identifies a session: nothing more, nothing less. It does not identify a user.

You cannot and should not rely on session IDs ever being reused, let alone for the same user.

Upvotes: 8

Related Questions